Use modern checksum algorithms during release

Apache policy requires that we drop generating MD5 / SHA1 checksums and switch:

– for new releases :
– you MUST supply a SHA-256 and/or SHA-512 file
– you SHOULD NOT supply MD5 or SHA-1 files
See http://www.apache.org/dev/release-distribution#sigs-and-sums

Best place to do this would be the parent-pom.

Its a bit of a blocker for producing any new releases unless sub-projects override all the code-signing provisions in the UIMA parent pom.